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INSPECTOR  GENERAL 
DEPARTMENT  OF  DEFENSE 
400  ARMY  NAVY  DRIVE 
ARLINGTON,  VIRGINIA  22202-4704 

MAR  1  6  2011 

MEMORANDUM  FOR  DIRECTOR,  DEFENSE  LOGISTICS  AGENCY 

SUBJECT:  External  Quality  Control  Review  of  the  Defense  Logistics  Agency  Audit 
Organization  (Report  No.  D-201 1-6-005) 

We  are  providing  this  report  for  your  information  and  use.  We  have  reviewed  the 
system  of  quality  control  for  the  audit  organization  of  the  Defense  Logistics  Agency 
(DLA)  in  effect  for  the  period  ended  May  3 1,  2010.  A  system  of  quality  control  for 
DLA’s  audit  organization  encompasses  the  audit  organization’s  leadership,  emphasis  on 
performing  high  quality  work,  and  policies  and  procedures  established  to  provide 
reasonable  assurance  of  compliance  with  generally  accepted  government  auditing 
standards  (GAGAS).  DLA  is  responsible  for  designing  a  system  of  quality  control  and 
complying  with  its  system  to  provide  DLA  with  reasonable  assurance  that  its  audits  are 
performed  and  reported  on  in  accordance  with  GAGAS  in  all  material  respects. 

Our  review  was  conducted  in  accordance  with  GAGAS  and  guidelines  established 
by  the  Council  of  the  Inspectors  General  on  Integrity  and  Efficiency.  We  tested  the  DLA 
audit  organization’s  system  of  quality  control  to  the  extent  we  considered  appropriate. 
GAGAS  require  that  an  audit  organization  performing  audits  or  attestation  engagements, 
or  both,  in  accordance  with  GAGAS  have  a  suitably  designed  internal  quality  control 
system  in  place  and  undergo  an  external  quality  control  review  at  least  once  every  three 
years  by  reviewers  independent  of  the  audit  organization  being  reviewed.  An  audit 
organization’s  quality  control  policies  and  procedures  should  include  and  be  consistent 
with  GAGAS  requirements  for  quality  control. 

Federal  audit  organizations  can  receive  a  rating  of  pass,  pass  with  deficiencies,  or 
fail.  In  our  opinion,  the  DLA  audit  organization’s  system  of  quality  control  for  audits 
and  attestation  engagements  was  not  designed  in  accordance  with  GAGAS.  Further,  the 
internal  quality  control  system  was  not  operating  effectively  to  provide  reasonable 
assurance  that  the  DLA  audit  organization’s  personnel  were  following  established 
guidance,  policies,  procedures,  and  applicable  auditing  standards.  Accordingly,  as  a 
result  of  the  significant  deficiencies  described  in  Appendix  A,  we  are  issuing  a  fail 
opinion  on  the  DLA  audit  organization’s  system  of  quality  control  used  on  audits  and 
attestation  engagements  for  the  review  period  ended  May  31,  2010. 

Appendix  A  contains  matters  that  resulted  in  the  fail  opinion.  In  addition, 
Appendix  A  contains  comments,  observations,  and  recommendations  where  the  DLA 
audit  organization  can  improve  its  quality  control  program  related  to  auditing  and 


attestation  engagement  practices.  Appendix  B  contains  a  summary  of  the  results  of  our 
interviews  with  DLA  audit  staff.  Appendix  C  contains  the  scope  and  methodology  of  the 
review.  Appendix  D  provides  the  full  text  of  management  comments  in  response  to  the 
draft  report. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Ms.  Carolyn  R.  Davis  at  (703)  604-8877 
(DSN  664-8877). 


Randolph  R.  Stone,  SES 
Deputy  Inspector  General 
for  Policy  and  Oversight 
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Appendix  A.  Comments,  Observations,  and 
Recommendations 


Defense  Logistics  Agency 

The  Defense  Logistics  Agency  (DLA)  is  the  Department  of  Defense’s  largest  logistics  combat 
support  agency,  providing  worldwide  logistics  support  in  both  peacetime  and  wartime  to  the 
military  services  as  well  as  several  civilian  agencies  and  foreign  countries.  DLA  is 
headquartered  at  Fort  Belvoir  in  Northern  Virginia  and  had  nearly  $41  billion  in  FY  2010 
revenues.  DLA  employs  about  27,000  civilian  and  military  employees,  supports  nearly  1,900 
weapon  systems,  and  manages  eight  supply  chains  and  nearly  5  million  items.  DLA  operates  in 
48  states  and  28  countries,  and  processes  1 16,000  requisitions  and  nearly  10,000  contract  actions 
a  day.  DLA  supports  humanitarian  relief  efforts  within  the  United  States  and  abroad,  provides 
logistics  support  to  other  federal  agencies,  and  had  FY  2010  foreign  military  sales  of  about 
$1.6  billion,  supporting  118  nations. 

DLA  Audit  Organization 

DLA  has  the  DLA  Accountability  Office  at  Headquarters  DLA;  one  audit  office  at  the  DLA 
Logistics  Infonnation  Service  in  Battle  Creek,  Michigan;  and  audit  offices  at  each  of  the  six 
DLA  Primary  Level  Field  Activities.  The  DLA  Accountability  Office  leverages  audit  and 
investigative  expertise  to  provide  DLA  leadership  with  timely  facts  to  make  informed  decisions 
for  improving  efficiency,  accountability  and  warfighter  support.  The  six  DLA  Primary  Level 
Field  Activities  with  co-located  audit  offices  are  DLA  Land  and  Maritime,  Columbus,  Ohio; 
DLA  Aviation,  Richmond,  Virginia;  DLA  Troop  Support,  Philadelphia,  Pennsylvania; 

DLA  Energy,  Fort  Belvoir,  Virginia;  DLA  Distribution,  New  Cumberland,  Pennsylvania;  and 
DLA  Disposition  Services,  Battle  Creek,  Michigan.  DLA  has  a  decentralized  audit  function, 
each  of  the  field  office  Audit  Directors  report  directly  to  their  local  Commander/Deputy 
Commander  for  day-to-day  administrative  and  operational  issues  and  not  to  the  DLA 
Accountability  Office.  Additional  details  on  the  DLA  audit  organization  and  the  scope  and 
methodology  for  this  review  are  contained  at  Appendix  C. 

Quality  Control  System  Deficient 

We  identified  significant  deficiencies  that  existed  in  the  DLA  audit  organization’s  quality  control 
system.  The  system  of  quality  control  was  not  suitably  designed  or  complied  with  to  provide 
reasonable  assurance  of  performing  and/or  reporting  in  confonnity  with  generally  accepted 
government  auditing  standards  (GAGAS)  in  all  material  respects.  Therefore,  we  are  issuing  a 
fail  opinion  on  their  external  quality  control  review. 
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Significant  deficiencies  affecting  our  opinion  on  the  system  of  quality  control  are: 

•  material  deficiencies  in  the  design  of  the  audit  quality  control  system  including 
absence  of  official  quality  control  policies  and  procedures,  and  lack  of  a  formal  audit 
quality  assurance  function; 

•  perfonnance  of  nonaudit  services,  which  resulted  in  an  organizational  impairment  to 
independence;  and 

•  failure  to  exercise  sufficient  professional  judgment  as  evidenced  by  substantive 
noncompliances  with  GAGAS  on  audit  assignments. 

The  DLA  audit  organization’s  current  quality  control  program  for  audits  and  attestation 
engagements  showed  evidence  of  substantive  noncompliances  in  six  additional  GAGAS  areas: 

•  competence, 

•  planning, 

•  supervision, 

•  evidence, 

•  documentation,  and 

•  reporting. 

Further,  current  procedures  for  ensuring  that  all  audit  offices  prepare  and  submit  an  annual  audit 
plan  and  maintaining  an  up-to-date  listing  of  audit  reports  issued  by  the  audit  organization  need 
improvement.  Implementing  the  recommendations  identified  in  this  report  would  assist  DLA’s 
efforts  in  improving  their  audit  organization’s  system  of  quality  control  thereby  achieving 
compliance  with  GAGAS  requirements. 
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Significant  Deficiencies  in  the  Design  and  Operation  of  the 
Audit  Quality  Control  System 

GAGAS  3.51  states  that  an  audit  organization’s  system  of  quality  control  encompasses  the  audit 
organization’s  leadership,  emphasis  on  performing  high  quality  work,  and  the  audit 
organization’s  policies  and  procedures  designed  to  provide  reasonable  assurance  of  complying 
with  professional  standards  and  applicable  legal  and  regulatory  requirements.  We  found  that 
DLA’s  audit  organization  had  significant  deficiencies  in  its  system  of  quality  control. 

The  significant  deficiencies  in  the  design  and  operation  of  the  DLA  audit  quality  control  system 
included: 

•  consideration  of  DLA  audit  policy  as  non-binding  guidance  only  and  insufficiency  of 
DLA  guidance  on  attestation  engagements  and  other  standards  areas  detailed 
throughout  the  report, 

•  lack  of  a  fonnal  quality  control  and  assurance  program, 

•  creation  of  an  organizational  impairment  to  independence  through  the  performance  of 
nonaudit  services  and  audit  office  reporting  structure,  and 

•  the  lack  of  professional  judgment  evidenced  by  multiple  GAGAS  noncompliances 
within  the  eight  DLA  Headquarters  and  field  audit  offices. 

These  deficiencies  as  detailed  below  provided  the  basis  for  the  opinion  and  our  concern  about  the 
inability  of  the  DLA  audit  quality  control  system  to  provide  reasonable  assurance  of  compliance 
with  GAGAS. 

Official  Policy  vs.  Guidance 

The  DLA  Accountability  Office,  Audit  Division ’s  policies,  to  include  the  Enterprise  Audit 
Procedures  and  the  Audit  Quality  Control  and  Assurance  Policy  (QCAP),  are  frequently 
viewed  as  non-binding  guidance  by  many  audit  office  personnel.  This  conflict  existed  because 
the  DLA  guidance  was  not  subject  to  the  agency’s  official  policy  coordination  procedures,  to 
include  final  approval  by  the  Director,  DLA.  The  Enterprise  Audit  Procedures  and  QCAP  were 
issued  as  interim  updates  to  the  DLA  One  Book  Process  Chapter,  “Internal  Audit  Process,” 
during  August  2009.  Audit  Division  management  stated  that  the  QCAP  was  developed  to 
prepare  for  the  upcoming  DoD  Office  of  the  Inspector  General  quality  control  review,  and  to 
ensure  that  the  agency  had  a  similar  quality  control  system  throughout  all  DLA  audit  offices. 

The  QCAP  transmittal  memorandum,  signed  by  the  Director,  DLA  Accountability  Office, 
contains  the  following  infonnation: 
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The  attached  handbook  is  issued  as  an  interim  update  to  the  Internal  Audit  One  Book 
chapter.  When  the  revised  Internal  Audit  Process  One  Book  chapter  is  ready  for  staffing 
with  the  Enterprise,  the  handbook  will  be  formally  staffed  along  with  the  chapter.  In  the 
interim,  all  auditors  and  audit  staff  should  use  these  procedures  as  guidelines  for  new 
audits  to  achieve  as  much  of  an  Enterprise  approach  as  practical  pending  final  policy 
issuance.  Ongoing  audits  should  be  evaluated  to  determine  which  steps  could  be 
implemented  now. 

Failure  to  Complete  Official  Policy  Coordination  and  Implementation 

In  May  2010,  the  DLA  Accountability  Office,  Audit  Division,  issued  three  draft  audit 
Instructions,  one  of  which  pertained  to  the  Internal  Audit  Process.  The  DLA  One  Book  Process 
Chapter,  “Internal  Audit  Process,”  will  be  canceled  when  the  draft  Internal  Audit  Process 
Instruction  is  finalized.  The  Enterprise  Audit  Procedures  and  the  QCAP  will  become 
supplemental  policy  for  the  Internal  Audit  Process  Instruction.  In  an  effort  to  officially 
coordinate  the  draft  Instructions,  Audit  Division  leadership  provided  the  staff  with  opportunities 
to  submit  feedback  and  propose  changes  to  the  draft  documents.  However,  as  of  December 
2010,  the  DLA  Accountability  Office,  Audit  Division,  had  not  completed  the  official 
coordination  and  implementation  of  the  proposed  Instructions.  Coordination  of  these  draft 
policies  was  delayed  due  to  continued  disagreements  with  audit  office  personnel  regarding  the 
contents  of  the  draft  Instructions.  Similarly,  as  of  December  2010,  the  DLA  Accountability 
Office,  Audit  Division,  had  not  completed  the  official  policy  coordination  or  implementation  of 
the  Enterprise  Audit  Procedures  and  QCAP. 

Lack  of  Official  Policy  Resulting  in  Poor  or  Inconsistently  Utilized 
Quality  Controls 

As  a  result  of  the  ongoing  disagreements  regarding  official  policies  and  guidance,  some  quality 
assurance  policies,  including  report  indexing  and  independent  referencing,  were  not  followed 
during  the  conduct  of  local  audits  completed  after  August  2009.  Our  review  of  audit  projects 
disclosed  that  seven  of  the  eight  audit  offices  were  not  following  the  quality  assurance  policies, 
or  in  some  instances,  the  policies  were  not  consistently  followed. 

The  QCAP  and  Enterprise  Audit  Procedures  require  that  draft  audit  reports  are  referenced1,  and 
the  accuracy  of  the  report  content  is  verified  by  an  independent  reference  reviewer.  However, 
we  noted  an  audit  project  that  did  not  contain  references  to  report  statements  and  the  report 
statements  were  not  supported  by  audit  documentation.  For  report  No.  08-07,  “Audit  Report  of 
the  Verification  of  Project  765’s  Account  Balance,”  June  1,  2009,  in  response  to  deficiencies  we 
identified,  the  Deputy  Commander,  DLA  Energy,  responded  and  stated  that  the  office  has 
implemented  new  independent  reference  review  procedures  with  independent  reference  reviews 
being  conducted  by  other  DLA  audit  offices. 


1  Referencing  is  a  quality  control  process  in  which  an  experienced  auditor  who  is  independent  of  the  audit  checks 
that  statements  of  facts,  figures,  and  dates  are  correctly  reported,  that  the  findings  are  adequately  supported  by  the 
evidence  in  the  audit  documentation,  and  that  the  conclusions  and  recommendations  flow  logically  from  the 
evidence. 
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Another  audit  project  did  not  include  any  evidence  of  the  auditor’s  analytical  work  in  the  project 
files  and  we  are  recommending  rescission  of  that  report.  For  report  number  DAF-09-06, 
“Validation  Report  of  Corrective  Actions  Taken  for  Plan  of  Actions  and  Milestones  15,  Contract 
Modification  to  Match  DESC  Guidance,”  November  2009,  the  DLA  Energy  audit  office 
complied  with  the  QCAP  requirement  for  an  independent  reference  review;  the  review  did  not 
ensure  that  the  audit  working  papers  adequately  supported  the  report.  The  Deputy  Commander, 
DLA  Energy,  stated  that  DLA  Energy’s  Internal  Review  office  requested  the  DLA 
Accountability  Office,  Audit  Division,  to  perfonn  the  quality  review.  The  DLA  Accountability 
Office,  Audit  Division  reviewer  did  not  identify  any  deficiencies  noted  by  the  Department  of 
Defense,  Office  of  Inspector  General.  In  both  instances,  the  independent  reference  reviewers  did 
not  document  any  concerns  about  the  lack  of  supporting  documentation  during  their  reviews. 

The  inconsistent  application  of  the  interim  guidance  has  weakened  the  organization ’s  system 
of  quality  control.  Further,  DLA  audit  organization  management  continues  to  rely  on  interim 
guidance  instead  of  official  policies  and  procedures  to  maintain  its  system  of  quality  control  and 
assurance.  Ongoing  disagreements  regarding  the  contents  of  the  draft  Instructions  have  delayed 
the  DLA  Accountability  Office,  Audit  Division’s  efforts  to  implement  official  audit  policies  and 
procedures. 

Attestation  Guidance  Needs  Improvement 

The  audit  organization ’s  current  policies  do  not  ensure  that  auditors  performing  attestation 
engagements  are  knowledgeable  in  American  Institute  of  Certified  Public  Accountants 
(AICPA)  general  attestation  standard  related  to  criteria,  attestation  standards  for  field  work 
and  reporting,  and  the  related  Statements  on  Standards  for  Attestation  Engagements,  as 
required  by  GAGAS  3.45.  The  QCAP  contains  minimal  guidance  for  conducting  attestation 
engagements.  For  example,  Section  1 100  of  the  QCAP  states:  “In  this  document,  the  term  audit 
includes  performance  audits  and  attestation  engagements.”  Audit  Division  management  stated: 

Specific  guidance  for  attestation  engagements  has  not  been  issued  by  the  DLA 
Accountability  Office.  According  to  paragraph  1 100  of  the  Audit  Quality  Control  and 
Assurance  Policy,  the  temi  “audit”  includes  both  audits  and  attestations.  Therefore,  the 
performance  audit  response  covers  both  perfomiance  audits  and  the  various  categories  of 
attestation  engagements. 

The  QCAP  guidance  and  management’s  statement  are  not  accurate.  GAGAS  Chapter  6  contains 
guidance  on  general,  field  work,  and  reporting  standards  for  attestation  engagements.  Chapter  6 
also  incorporates  the  AICPA  general  standards  on  criteria,  the  field  work  and  reporting 
standards,  and  the  related  Statements  on  Standards  for  Attestation  Engagements.  GAGAS 
Chapters  7  and  8  discuss  field  work  and  reporting  standards  for  perfonnance  audits. 

Lack  of  a  Formal  Audit  Quality  Assurance  Function 

The  DLA  audit  organization  lacked  an  audit  quality  assurance  function  until  December  2009, 
when  one  quality  assurance  auditor  position  was  established.  However,  since  the 
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appointment,  the  quality  assurance  auditor  has  not  conducted  any  reviews  of  DLA  audit  work 
and  therefore  could  not  provide  any  evidence  of  quality  assurance  monitoring  as  required  by 
GAGAS  3.5 3 f.  GAGAS  3.53f  states  that  the  audit  organization  should  perfonn  monitoring 
procedures  that  enable  it  to  assess  compliance  with  applicable  professional  standards  and  quality 
control  policies  and  procedures  for  GAGAS  audits.  Therefore,  a  significant  deficiency  in  the 
design  of  the  audit  quality  control  system  exists,  since  a  fonnal  audit  quality  assurance  function 
was  established  and  team  members  have  not  conducted  any  audit  quality  control  monitoring. 

In  May  2010,  the  Quality  Assurance  and  Audit  Management  Systems  team  was  established. 
However,  the  Quality  Assurance  and  Audit  Management  Systems  team  has  not  initiated  any 
reviews  of  DLA  audit  work.  The  quality  assurance  auditor  and  team  members  conducted  a  peer 
review  of  the  Defense  Finance  and  Accounting  Service,  which  was  completed  on 
August  5,  2010.  In  addition,  the  DLA  Aviation  Audit  Office  performed  the  peer  review  of  the 
Defense  Commissary  Agency,  which  was  completed  on  August  3,  2010.  The  Office  of  the 
Assistant  Inspector  General  for  Audit  Policy  and  Oversight  will  perform  a  review  of  the  work 
related  to  the  Defense  Finance  and  Accounting  Service  and  Defense  Commissary  Agency  peer 
reviews  to  satisfy  ourselves  of  the  sufficiency  of  the  work  and  the  support  for  the  opinions. 
Currently,  the  team  is  working  on  updating  the  TeamMate  project  template,  updating  the  QCAP, 
and  is  scheduled  to  provide  training  to  DLA  auditors  on  various  audit  subjects  including 
evidence,  documentation,  and  planning. 

In  addition,  the  DLA  audit  organization  is  not  complying  with  the  annual  reporting 
requirement.  GAGAS  3.54  contains  the  following  requirement  for  quality  control  reviews: 

The  audit  organization  should  analyze  and  summarize  the  results  of  its  monitoring 
procedures  at  least  annually,  with  identification  of  any  systemic  issues  needing 
improvement,  along  with  recommendations  for  corrective  action. 

Further,  although  the  QCAP  contained  procedures  for  obtaining  a  listing  of  reports  to  inspect  for 
compliance  with  GAGAS  and  DLA  audit  policies,  the  guidance  did  not  contain  any  infonnation 
on  the  criteria  for  selecting  a  sample  to  gauge  high  risk  areas.  In  addition,  the  QCAP  does  not 
identify  any  risk  factors  for  the  quality  assurance  team  to  consider  when  perfonning  their  internal 
quality  assurance  reviews.  Lastly,  the  QCAP  does  not  address  the  appropriate  GAGAS 
standards  to  apply,  based  on  the  type  of  service  performed,  when  conducting  internal  quality 
assurance  reviews. 

Independence 

Changes  to  Audit  Office’s  Reporting  Structures  May  Create  an 
Organizational  Impairment  to  Independence 

DLA  senior  management  requested  a  change  to  the  DLA  Accountability  Office,  Audit  Division’s 
reporting  structure  during  October  2009.  At  this  time,  the  Director,  Accountability  Office,  Audit 
Division,  reported  to  the  DLA  Vice  Director  for  day-to-day  administrative  and  operational 
issues,  and  the  overall  execution  of  the  office’s  mission.  However,  when  the  Vice  Director  left 
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the  position,  the  vacancy  was  not  filled.  As  a  result,  the  DLA  Accountability  Office,  Audit 
Division’s,  reporting  structure  was  realigned  and  the  Director  was  required  to  report  to  the  Chief 
of  Staff  for  day-to-day  administrative  and  operational  issues,  and  the  overall  execution  of  the 
office’s  mission.  DLA  senior  management  maintained  that  the  new  reporting  structure  would 
ensure  direct  and  open  access  to  the  Director,  DLA,  organizational  independence,  and  meet 
GAGAS.  The  realignment  also  required  the  Director,  DLA  Accountability  Office,  to  ensure  that 
all  audit  and  investigative  results  are  provided  to  the  Director,  DLA,  in  a  timely  manner  without 
any  undue  influence  from  any  DLA  component. 

In  addition,  DLA  Aviation  senior  management  proposed  a  similar  change  to  the  Internal  Audit 
Office’s  reporting  structure  during  July  2010.  This  proposed  change  would  require  the  DLA 
Aviation  Audit  Director  to  report  to  the  DLA  Aviation  Chief  of  Staff  for  day-to-day 
administrative  and  operational  issues.  DLA  Aviation  senior  management  maintains  that  the 
Audit  Director  would  still  have  direct  access  to  the  Commander  and/or  Deputy  Commander 
under  the  new  reporting  structure.  The  current  reporting  structure  requires  the  DLA  Aviation 
Audit  Director  to  report  directly  to  the  Commander  and/or  the  Deputy  Commander  for 
administrative  and  operational  issues. 

Changes  to  Reporting  Structure  in  Conflict  with  GAGAS 
Organizational  Independence  Requirements 

These  changes  to  the  reporting  structure  would  create  an  organizational  impairment  to 
independence.  Specifically,  GAGAS  3.16  outlines  five  specific  criteria  that  must  be  met  for  a 
government  internal  audit  function  to  be  presumed  free  from  organizational  impairments  to 
independence.  The  criteria  includes  that  the  internal  audit  function: 

•  should  be  accountable  to  the  head  or  deputy  head  of  the  government  entity  or  those 
charged  with  governance; 

•  should  report  the  audit  results  to  both  the  head  or  deputy  head  of  the  government 
entity  and  to  those  charged  with  governance; 

•  should  be  located  organizationally  outside  the  staff  or  line-management  function  of 
the  unit  under  audit; 

•  should  have  access  to  those  charged  with  governance  of  the  organization;  and 

•  should  be  sufficiently  removed  from  political  pressures  to  conduct  audits  and  report 
findings,  opinions,  and  conclusions  objectively  without  the  fear  of  political  reprisal. 

The  changes  to  the  current  reporting  structure  could  negatively  affect  the  DLA  Accountability 
Office,  Audit  Division,  and  DLA  Aviation,  Audit  Offices’  compliance  with  the  GAGAS  3.16 
criteria  that  the  head  of  the  audit  organization  be  accountable  to  the  head  or  deputy  head  of  the 
government  entity  or  those  charged  with  governance. 

It  is  important  for  a  government  internal  audit  function  to  be  presumed  free  from  organizational 
impairments  to  independence  in  order  to  ensure  that  its  opinions,  findings,  conclusions, 
judgments,  and  recommendations  are  viewed  as  impartial  by  those  charged  with  governance, 
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audit  clients,  and  objective  third  parties.  Further,  a  government  internal  audit  function’s 
reporting  structure  should  not  create  the  appearance  of  an  organizational  impairment  to 
independence. 

Agreement  and  Disagreement  with  GAGAS  Required  Reporting 
Structure  for  internal  Audit 

The  Director,  DLA,  agreed  with  our  recommendation  to  require  the  Director,  DLA 
Accountability  Office,  to  report  directly  to  him  for  operational  and  administrative  issues.  In 
response  to  a  similar  memorandum,  the  Commander,  DLA  Aviation,  stated  that  the  Chief  of  the 
Internal  Audit  Division  is  accountable  and  has  direct  access  to  the  Commander  and  Deputy 
Commander  at  all  times  for  any  concerns.  Further,  the  Internal  Audit  Division  is  located  outside 
the  line-management  function  of  the  units  under  audit,  and  is  sufficiently  removed  from  political 
pressures  to  conduct  audits  and  report  findings,  opinions,  and  conclusions  objectively  without 
fear  of  political  reprisal. 

We  do  not  agree  with  the  Commander,  DLA  Aviation’s,  response  to  our  recommendation.  The 
proposed  changes  to  the  reporting  structure  creates  an  organizational  impairment  to  the  audit 
offices’  independence  and  also  prohibits  compliance  with  GAGAS  3.16  requirements.  Further, 
we  recommend  that  any  DLA  audit  office  that  does  not  report  directly  to  their  local 
Commander  and/or  Deputy  Commander  immediately  realign  their  reporting  structures  to 
ensure  organizational  independence  in  both  fact  and  appearance. 

Performance  of  Nonaudit  Services  Created  an  Organizational 
Impairment  to  Independence 

Two  of  the  seventeen  engagements  we  selected  were  reported  by  DLA  as  audits  when  in  fact 
they  were  nonaudit  services  that  impaired  the  DLA  audit  organization’s  independence.  GAGAS 
3.22  discusses  two  overarching  principles  to  apply  to  auditor  independence  when  assessing  the 
impact  of  perfonning  a  nonaudit  service  -  that  auditors  must  not  perform  management  functions 
or  audit  their  own  work.  The  DLA  One  Book  Process  Chapter  “Internal  Audit  Process,” 
November  8,  2007,  also  states  that  staff  may  not  perfonn  management  operating  functions  or 
audit  their  own  work.  In  addition,  the  DLA  Accountability  Office,  Audit  Division,  QCAP, 
August  12,  2009,  contains  similar  guidance. 

Of  the  seventeen  engagements,  we  selected  two  engagements  pertaining  to  the  Office  of 
Management  and  Budget  (OMB)  Circular  A- 123,  Appendix  A,  internal  control  testing  to 
determine  the  effectiveness  of  the  applicable  GAGAS.  Auditors  from  the  DLA  Accountability 
Office,  Audit  Division,  and  DLA  Distribution  audit  offices  conducted  internal  control  testing  on 
the  following  engagements: 

•  Internal  Control  Testing  Related  to  the  Hire  to  Retire  Business  Cycle  as  Required  by 
Office  of  Management  and  Budget  Circular  A- 123,  Appendix  A,  report  number 
DAF-09-17;  and 
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•  Internal  Control  Testing  Related  to  Non  Energy  Inventory  Quantity  as  Required  by 
Office  of  Management  and  Budget  Circular  A- 123  Appendix  A,  report  number 
DDC-08-03. 

Management  Responsibility  to  Monitor  Internal  Control 

OMB  Circular  A- 123,  Management’s  Responsibility  for  Internal  Control,  December  21,  2004, 
which  implements  the  Federal  Manager’s  Financial  Integrity  Act  of  1982,  as  codified  in  3 1 
U.S.C.  3512,  states  that  management  is  responsible  for  establishing  and  maintaining  internal 
control,  and  that  management  has  the  responsibility  to  monitor  internal  control.  OMB  Circular 
A- 123  requires  that  management  perform  monitoring  activities  that  include  direct  testing  of 
controls  as  part  of  their  assessment  process.  Auditors  from  the  DLA  Accountability  Office, 

Audit  Division,  and  DLA  Distribution  audit  offices  performed  the  OMB  Circular  A- 123, 
Appendix  A,  internal  control  testing.  Further,  the  scope,  sample  sizes,  testing  approach,  and  the 
evaluation  procedures  were  directed  by  DLA  operations  management,  not  by  the  auditors. 

GAGAS  3.29j  classifies  this  type  of  work  as  a  nonaudit  service  that  would  impair  the  audit  office 
independence  with  regards  to  future  audits.  Since  the  DLA  Accountability  Office,  Audit 
Division,  and  DLA  Distribution  audit  offices  also  perfonn  operational  audits  of  depot  processes, 
the  auditors  would  be  reviewing  controls  they  previously  tested  for  DLA  operations  management 
when  conducting  these  types  of  reviews;  thereby  potentially  auditing  their  own  work  and 
performing  a  management  function  which  breaches  both  overarching  principles.  Consequently, 
the  DLA  Accountability  Office,  Audit  Division,  and  the  DLA  Distribution  audit  offices’ 
organizational  independence  was  impaired  because  they  performed  the  OMB  Circular  A- 123, 
Appendix  A,  internal  control  testing.  Specifically,  during  the  “Defense  Distribution  Depot  San 
Joaquin  (DDJC)  Distribution  Process  Review,”  report  number  DAO  09-072,  the  lead  auditor  on 
the  operational  audit  also  led  the  OMB  Circular  A- 123,  Appendix  A,  internal  control  testing 
review. 

On  October  29,  2010,  we  issued  a  Notice  of  Concern  to  alert  DLA  management  of  the 
organizational  impairment  to  independence.  The  Notice  of  Concern  recommended  that  the 
Director,  DLA,  mandate  that  the  DLA  Accountability  Office,  Audit  Division,  and  the  DLA  audit 
offices  discontinue  perfonning  the  OMB  Circular  A- 123,  Appendix  A,  internal  control  testing. 
On  December  2,  2010,  the  Director,  DLA  Accountability  Office,  issued  a  memorandum  to  all 
DLA  audit  offices  stating  that  all  nonaudit  services  related  to  OMB  Circular  A-123, 

Appendix  A,  work  should  immediately  cease. 


2  This  report  was  not  included  in  the  sample  of  17  reports  that  we  reviewed. 
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Professional  Judgment 

Failure  to  Exercise  Sufficient  Professional  Judgment 

We  determined  that  the  DLA  audit  organization  did  not  exercise  professional  judgment  due  to 
the  vast  array  of  noncompliances  found  in  the  majority  of  auditing  standards  areas  including,  but 
not  limited  to,  independence,  use  and  application  of  GAGAS,  planning,  supervision,  evidence, 
documentation,  reporting  and  quality  control.  Specific  examples  of  the  audit  organization’s  lack 
of  professional  judgment  are  included  in  the  table  below  and  discussed  in  detail  throughout  this 
report. 
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GAGAS 

Narrative  Citation 

Details  of  Deficiencies 

3.31 

Professional  judgment 
standard  requires  that 
auditors  use  professional 
judgment  in  planning  and 
perfonning  audits  and 
attestation  engagements, 
and  in  reporting  the 
results. 

In  reviewing  the  eight  DLA  audit  offices 
including  the  Headquarters  office,  we  found 
deficiencies  in  planning  at  six  of  the  eight  offices. 
At  DLA  Headquarters,  Disposition  Services, 
Energy,  Aviation,  and  Land  and  Maritime  audit 
offices,  we  found  that  audit  and  fraud  risk 
assessments  were  not  completed.  Additionally,  at 
DLA  Energy,  the  audit  program  did  not  reflect 
changes  in  audit  direction,  the  criteria  were  not 
identified  during  audit  planning,  the  audit 
program  did  not  contain  adequate  sample 
selection  information,  and  the  audit  plan  did  not 
adequately  address  relevant  risks.  We  also  found 
significant  reporting  deficiencies  in  four  of  eight 
offices  including  one  egregious  example  that 
necessitated  our  recommending  rescission  of  the 
report. 

3.32 

Professional  judgment 
includes  exercising 
reasonable  care  and 
professional  skepticism, 
which  is  an  attitude  that 
includes  a  questioning 
mind  and  a  critical 
assessment  of  evidence. 

At  the  DLA  Energy  audit  office,  we  found  no 
“critical  assessment  of  evidence”  for  one  report 
reviewed.  For  the  Plan  of  Actions  and 

Milestones  15  report,  the  working  papers 
described  analytical  work  completed;  however, 
the  project  file  did  not  contain  evidence  to  show 
that  the  work  described  was  completed. 

3.33 

Professional  judgment 
and  competence  are 
interrelated  because 
judgments  made  are 
dependent  upon  the 
auditors'  competence. 

We  found  in  the  DLA  Disposition  Services 
Vulnerability  Assessment  audit  that  the  staff  and 
supervisor  lacked  training  and  experience  in 
performing  and  reporting  on  attestation 
engagements. 

3.34 

In  addition  to  personnel 
directly  involved  in  the 
audit,  professional 
judgment  may  involve 
collaboration  with  other 
stakeholders,  outside 
experts,  and  management 
in  the  audit  organization. 

For  the  DLA  Headquarters  Nuclear  Weapons 
audit,  the  auditors  did  not  assess  the  professional 
qualifications  of  the  equipment  specialists  or 
document  the  specialists’  findings  and 
conclusions. 
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GAGAS 

Narrative  Citation 

Details  of  Deficiencies 

3.35 

Using  professional 
judgment  in  all  aspects  of 
carrying  out  auditors’ 
professional 
responsibilities  includes 
among  other  things, 
maintaining  appropriate 
quality  control  over  the 
assignment  process  as 
essential  to  perfonning 
and  reporting  on  an  audit. 

We  found  quality  control  deficiencies  at  seven  of 
eight  audit  offices.  Examples  of  significant 
deficiencies  in  quality  control  include  minimal 
and  non-substantive  independent  reference 
review  comments  rendering  the  quality  control 
procedure  ineffective;  missing  references  not 
questioned;  independent  reference  review  not 
disclosing  that  the  working  papers  did  not 
adequately  support  the  report;  and  reference 
review  completed  but  not  documented. 

3.38 

Auditors  are  required  to 
document  significant 
decisions  affecting  the 
audit  objectives,  scope, 
and  methodology; 
findings;  conclusions;  and 
recommendations 
resulting  from 
professional  judgment. 

GAGAS  3.38  requirements  are  not  specifically 
mentioned  or  discussed  in  the  current  DLA  policy 
or  guidance.  The  absence  of  policies  and 
procedures  regarding  the  documentation  of 
auditor  decisions  resulting  from  professional 
judgment  negatively  impacted  the  projects 
included  in  our  review.  For  example,  at  several 
audit  offices  there  was  a  consistent  absence  of 
documentation  of  discussions  with  supervisors 
and  auditees  regarding  decisions  that  were 
material  to  the  overall  execution  of  the  work  in 
the  project  files.  For  two  projects  reviewed,  the 
audit  plans  did  not  contain  information  on  the 
sample  size  or  sample  methodology.  In  addition, 
another  project’s  audit  plan  was  not  updated  to 
document  a  significant  increase  to  the  original 
audit  sample  size,  which  was  based  on  the 
auditor’s  professional  judgment. 

Deficiencies  in  multiple  standards  areas,  which  evidences  a  lack  of  professional  judgment,  were 
reflected  at  all  DLA  audit  offices  visited  from  a  high  of  nine  standards  areas  at  DLA  Disposition 
Services  to  a  low  of  two  standards  areas  at  DLA  Infonnation  Services.  DLA  Headquarters  audit 
office  was  deficient  in  seven  standards  areas;  DLA  Energy  in  seven  standards  areas;  DLA 
Aviation,  and  DLA  Troop  Support  in  five  standards  areas;  DLA  Distribution  in  four  standards 
areas;  and  DLA  Land  and  Maritime  in  three  standards  areas.  The  significant  deficiencies  in  the 
quality  control  system  design,  independence,  and  professional  judgment  coupled  with  the 
deficiencies  in  multiple  other  GAGAS  standards  areas  serve  as  the  basis  for  the  fail  opinion.  We 
have  therefore  concluded  that  the  system  of  quality  control  for  the  DLA  audit  organization  in 
effect  for  the  period  ended  May  3 1,  2010,  was  not  suitably  designed  and  complied  with  to 
provide  reasonable  assurance  of  perfonning  and/or  reporting  audits  and  attestation  engagements 
in  compliance  with  GAGAS  in  all  material  respects. 
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Competence 


Collective  Competence  Questionable  Due  to  Lack  of  Professional 
Judgment  Evidenced  by  Significant  GAGAS  Noncompliances,  gagas 

requires  that  the  staff  assigned  to  perfonn  the  audit  or  attestation  engagement  must  collectively 
possess  adequate  professional  competence  for  the  tasks  required.  GAGAS  further  emphasizes 
that  Competence  enables  an  auditor  to  make  sound  professional  judgments.  The  multiple 
noncompliances  with  GAGAS  bring  into  question  the  collective  competence  within  the  DLA 
audit  organization  and  the  ability  of  their  auditors  to  make  sound  professional  judgments.  We 
found  several  examples  of  lack  of  sound  professional  judgment  including-. 

•  Audit  planning  was  deficient  at  six  of  eight  audit  offices  and  auditors  in  five  of  eight 
audit  offices  did  not  perform  audit  or  fraud  risk  assessments. 

•  Two  offices  including  the  Headquarters  DLA  audit  office  were  performing  OMB 
Circular  A- 123  internal  control  testing,  which  breaches  the  GAGAS  independence 
overarching  principles  of  not  reviewing  your  own  work  or  performing  management 
functions. 

•  Two  audit  offices  including  the  Headquarters  DLA  audit  office  lacked  knowledge  of 
standards  for  planning,  performing  and  reporting  on  attestation  engagements. 

•  Poor  design  of  audit  methodology  including  sampling  selection  deficiencies  were 
found  at  two  of  eight  offices. 

•  At  one  audit  office,  working  papers  were  deemed  substandard  -  they  described  the 
analytical  work  completed,  but  the  project  file  did  not  contain  evidence  showing  the 
work  described  was  completed.  Additionally,  the  auditor  had  only  two  years  of  audit 
experience  and  very  limited  supervision. 

•  Quality  supervision  was  lacking  in  at  least  five  of  eight  audit  offices  and 
documentation  of  audit  work  performed  was  poor  at  five  of  eight  audit  offices. 

•  Quality  controls  when  used  were  poorly  executed,  consequently  diminishing  the 
effectiveness  of  the  quality  control  procedures. 

GAGAS  Knowledge  Prior  to  Performing  Audits  or  Attestation 
Engagements 

The  DLA  Accountability  Office,  Audit  Division,  and  the  DLA  Disposition  Services  audit 
offices  did  not  have  a  clear  understanding  of  what  constituted  an  audit  or  attestation 
engagement.  GAGAS  paragraph  3.40  states  that  auditors  assigned  to  perform  an  audit  or 
attestation  engagement  must  collectively  possess  adequate  professional  competence  for  the  tasks 
required.  While  reviewing  an  audit,  we  learned  that  fieldwork  was  conducted  as  a  performance 
audit;  however,  the  GAGAS  statement  in  the  report  indicated  that  the  work  was  performed  in 
accordance  with  attestation  standards.  Audit  staff  and  supervisors  lacked  training  and 
experience  in  performing  and  reporting  on  attestation  engagements.  Further,  the  auditors  and 
supervisors  did  not  have  sufficient  understanding  of  GAGAS  Chapter  6,  General,  Field  Work, 
and  Reporting  Standards  for  Attestation  Engagements  and  the  AICPA  Statements  of  Standards 
for  Attestation  Engagements.  Audit  management  at  the  DLA  Accountability  Office,  Audit 
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Division,  and  the  DLA  Disposition  Services  audit  offices  supervised  a  Vulnerability  Assessment 
audit  as  a  performance  audit,  but  reported  that  the  audit  was  conducted  as  an  attestation 
engagement.  The  two  audit  office  managers  agreed  that  the  Vulnerability  Assessment  audit  was 
misclassified  and  the  report  cited  an  incorrect  GAGAS  standard. 

Use  of  the  Work  of  External  Specialists 

GAGAS  paragraph  3.49  states  that  auditors  who  use  the  work  of  external  specialists  should 
assess  the  professional  qualifications  of  these  specialists  and  document  their  findings  and 
conclusions.  During  the  review  of  an  audit,  we  noted  noncompliance  with  this  GAGAS 
standard.  Specifically,  the  auditors  did  not  assess  the  professional  qualifications  of  the 
equipment  specialists  or  document  their  findings  and  conclusions  in  the  audit  working  papers. 
The  equipment  specialists,  Air  Force  personnel,  were  the  key  technical  people  that  detennined 
the  applicability  of  parts,  subassemblies,  and  assemblies  for  transfer  out  of  DLA  possession  and 
into  Air  Force  possession.  As  a  result,  the  auditors  depended  on  the  work  of  external  specialists 
without  evaluating  their  professional  qualifications  or  reliability  of  their  work. 

Need  for  Review  and  Formalization  of  DLA  Audit  Organization 
Process  for  Maintaining  a  Competent  Workforce 

Though  only  two  auditors  were  found  to  not  meet  the  GAGAS  continuing  professional  education 
requirements  outlined  in  GAGAS  3.46  through  3.48,  the  multiple  noncompliances  with  GAGAS 
throughout  the  eight  DLA  audit  offices  indicates  a  need  for  review  and  formalization  of  the  DLA 
audit  organization’s  process  for  recruitment,  hiring,  continuous  development,  assignment,  and 
evaluation  of  staff  to  ensure  maintenance  of  a  competent  workforce.  Factors  to  consider  in  the 
formalization  of  the  process  should  include  review  of  the  size  of  the  audit  organization,  its 
structure,  and  the  work  being  perfonned. 

Planning 

Deficiencies  in  Audit  Planning 

We  found  that  six  of  eight  audit  offices  lacked  compliance  with  GAGAS  requirements  for  audit 
planning.  Most  deficiencies  in  audit  planning  were  caused  by  a  lack  of  documentation  of  audit 
risk  assessments  and/or  fraud  risk  assessments.  GAGAS  7.07  states  that  in  planning  the  audit, 
auditors  should  assess  the  significance  and  audit  risk,  and  apply  these  assessments  in  defining  the 
audit  objectives,  and  the  scope  and  methodology  to  address  those  objectives.  Also,  GAGAS  7.30 
states  that  in  planning  the  audit,  auditors  should  assess  risks  of  fraud  that  are  significant  within 
the  context  of  the  audit  objectives. 

GAGAS  7.51  further  states  that  a  written  audit  plan  provides  an  opportunity  for  the  audit 
organization  management  to  supervise  audit  planning,  and  to  detennine  whether  the  proposed 
audit  scope  and  methodology  are  adequate  to  address  the  audit  objectives,  and  available  evidence 
is  likely  to  be  sufficient  and  appropriate  for  purposes  of  the  audit. 
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The  table  that  follows  details  the  deficiencies  in  planning  at  the  various  DLA  audit  offices  in 
addition  to  the  non-performance  of  audit  and  fraud  risk  assessments. 


Location 

Listing  of  Planning  Deficiencies 
(In  Addition  to  Lack  of  Risk  Assessment  Planning) 

Headquarters 

•  Project  file  contained  a  report  that  identified  risks  for  the  same  subject 
area.  However,  a  summary  work  paper  was  not  prepared.  As  a  result, 
there  was  no  evidence  that  prior  audit  risks  were  considered  during 
the  audit  planning.  (Report  No.  DAO-09- 10) 

Disposition 

Services 

•  Auditors  did  not  design  the  methodology  to  provide  reasonable 
assurance  that  the  evidence  was  sufficient  and  appropriate  to  support 
the  auditor’s  recommendations  and  conclusions.  Specifically,  the 
audit  program  did  not  contain  adequate  infonnation  regarding  the 
sample  selection  methodology,  and  the  program  steps  were  not  very 
detailed  or  descriptive.  (Report  No.  DRMS-09-03) 

Energy 

•  Auditors  did  not  design  the  methodology  to  provide  reasonable 
assurance  that  the  evidence  was  sufficient  and  appropriate. 

Specifically,  the  audit  program  was  not  updated  to  reflect  changes  in 
the  direction  of  the  audit.  (Report  No.  08-07) 

•  Criteria  were  not  identified  during  audit  planning.  However,  the  final 
report  contained  references  to  specific  criteria.  (Report  No.  08-07) 

•  The  audit  program  did  not  contain  adequate  information  regarding  the 
sample  selection  methodology.  The  program  steps  were  not  detailed 
or  descriptive.  The  audit  plan  did  not  adequately  address  relevant 
risks.  (Report  No.  DAF-09-26) 

Aviation 

•  The  audit  plans  did  not  adequately  identify  relevant  risks. 

•  The  audit  plan  was  not  updated  to  include  significant  changes  made  to 
the  plan  during  the  audit.  (Report  No.  IA-DSCR-CFOAP-2008-01) 

Troop 

Support 

•  The  audit  office  indicated  that  two  reports  were  terminated  during  the 
review  period  of  FYs  2008-2010.  However,  the  reasons  for 
termination  were  not  documented  in  accordance  with  GAGAS. 
Therefore,  we  could  not  determine  if  the  reasons  for  tenninating  the 
work  was  justified. 

Land  and 
Maritime 

•  The  audit  program  was  not  approved  by  the  supervisor  until  the  end  of 
the  audit.  (Report  No.  DSCC-DI-09-49) 
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Policies  Lacking  for  Information  System  Controls  and  Computer 
Processed  Information 


The  audit  organization’s  current  policies  for  complying  with  GAGAS  7.23-7.27,  “Information 
Systems  Controls,”  are  not  adequate.  Specifically,  the  QCAP,  Section  3610,  requires  that 
auditors  assess  audit  risk  and  significance  within  the  audit  objectives  by  gaining  an 
understanding  of  infonnation  system  controls  for  purposes  of  assessing  audit  risk  and  planning 
the  audit  within  the  context  of  the  audit  objectives.  In  contrast,  GAGAS  7.23-7.27  contains 
detailed  guidance  on  the  purpose  of  general  and  application  system  controls,  the  auditor’s 
determination  of  the  significance  of  the  infonnation  system  controls,  factors  to  consider  when 
determining  audit  procedures  necessary  to  obtain  sufficient  and  appropriate  evidence  to  support 
the  audit  findings  and  conclusions.  Current  DLA  audit  policies  and  procedures  also  do  not 
address  the  auditor’s  responsibility  in  assessing  the  sufficiency  and  appropriateness  of 
computer-processed  information,  whether  that  information  is  client-provided  or  auditor- 
extracted,  as  required  by  GAGAS  7.65. 

Termination  of  Audits 

Current  DLA  policies  and  guidance  do  not  contain  procedures  regarding  the  preparation  of 
documentation  for  audit  engagements  terminated  before  completion,  as  required  by  GAGAS 
7.49.  For  example,  one  audit  office  tenninated  two  audits  during  the  review  period;  however, 
the  audit  office  could  not  provide  adequate  documentation  to  support  the  reasons  for  tenninating 
the  work.  GAGAS  7.49  states  that  if  an  audit  is  terminated  before  it  is  completed  and  an  audit 
report  is  not  issued,  auditors  should  document  the  results  of  the  work  to  the  date  of  termination 
and  why  the  audit  was  terminated.  Detennining  whether  and  how  to  communicate  the  reason  for 
terminating  the  audit  to  those  charged  with  governance,  appropriate  officials  of  the  audited 
entity,  the  entity  contracting  for  or  requesting  the  audit  and  other  appropriate  officials  will 
depend  on  the  facts  and  circumstances,  and  therefore,  is  a  matter  of  professional  judgment. 

Since  the  terminated  audits  were  not  documented  in  accordance  with  GAGAS,  we  could  not 
determine  whether  the  reasons  for  ending  the  audits  were  justified. 

Supervision 

Deficiencies  in  Audit  Supervision 

We  detennined  that  ineffective  supervision  existed  at  five  of  eight  offices  that  contributed  to  the 
deficient  audit  work  that  was  evidenced  in  our  review.  GAGAS  7.52  states  that  audit  supervisors 
or  those  designated  to  supervise  auditors  must  properly  supervise  audit  staff.  At  three  of  the 
eight  audit  offices,  supervisors  either  did  not  provide  any  comments  to  the  audit  working  papers 
or  provided  comments  that  were  not  substantive. 

GAGAS  7.53  states  that  audit  supervision  involves  providing  sufficient  guidance  and  direction  to 
staff  assigned  to  the  audit  to  address  the  audit  objectives  and  follow  applicable  standards,  while 
staying  infonned  about  significant  problems  encountered,  reviewing  the  work  performed,  and 


18 


providing  effective  on-the-job  training.  Throughout  our  review  of  DLA  audits,  we  noted  that 
meetings  or  discussions  with  audit  supervisors  were  not  documented  to  show  the  extent  of  the 
supervisor’s  involvement  in  significant  decisions  and/or  the  amount  of  supervision  provided.  As 
a  result,  reviewers  could  not  determine  the  level  or  frequency  of  audit  supervision,  beyond 
documentation  of  supervisory  reviews  of  audit  working  papers  in  TeamMate. 

One  egregious  example  of  poor  supervision  occurred  at  the  DLA  Energy  audit  office.  For  report 
number  DAF-09-26,  “Validation  Report  of  Corrective  Actions  Taken  for  Plan  of  Actions  and 
Milestones  15,  Contract  Modification  to  Match  DESC  Guidance,”  November  2009,  we  found 
inadequate  supervision  was  provided  to  an  auditor  with  approximately  two  years  of  experience 
as  evidenced  by  the  absence  of  substantive  review  comments  considering  the  complexity  of  the 
review,  experience  of  staff,  and  substandard  quality  of  the  audit  documentation  and  evidence. 
During  these  two  years,  the  auditor  experienced  a  revolving  door  of  supervisors;  one  supervisor 
retired,  another  supervisor  left  after  six  months,  and  there  were  two  acting  supervisors.  All  of 
the  supervisors  should  have  ensured  that  the  audit  project  documentation  included  their 
supervisory  review  of  work  perfonned  during  their  tenure  and  the  acting  supervisor  at  the  time 
the  report  was  issued  should  have  ensured  that  the  audit  documentation  fully  supported  the 
report. 

GAGAS  7.54  states  that  the  nature  and  extent  of  the  supervision  of  staff  and  the  review  of  audit 
work  may  vary  depending  on  a  number  of  factors,  such  as  the  size  of  the  audit  organization,  the 
significance  of  the  work,  and  the  experience  of  the  staff.  Clearly  the  standard  as  indicated  in 
GAGAS  7.54  was  breached  given  the  lack  of  consistent  and  knowledgeable  supervisory 
oversight  in  the  DLA  Energy  Validation  Report  that  allowed  an  inexperienced  auditor  to 
extend  the  reporting  phase  of  the  audit  for  many  additional  months  with  insufficient 
supervisory  review. 

Deficiencies  in  Documentation  of  Supervisory  Review 

GAGAS  7.80c  states  that  auditors  should  document  evidence  of  supervisory  review,  before  the 
audit  report  is  issued,  of  the  work  performed  that  supports  findings,  conclusions,  and 
recommendations  contained  in  the  audit  report.  Review  of  audit  documentation  disclosed  that 
five  of  the  eight  offices  did  not  comply  with  this  GAGAS  requirement.  Specific  examples 
include  the  following  deficiencies: 

•  Supervisory  review  of  numerous  working  papers  occurred  after  the  final  report  date, 
and  project  documentation  was  revised  after  a  final  report  was  issued. 

•  Audit  working  papers  did  not  contain  evidence  of  supervisory  review  for  the  majority 
of  the  working  papers  prior  to  the  issuance  of  the  draft  report.  Instead,  the  supervisor 
reviewed  the  working  papers  at  the  end  of  the  audit  rather  than  throughout  the  audit 
process. 
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•  A  project  file  contained  documentation  of  supervisory  reviews  for  working  papers 
that  were  prepared  early  in  the  audit.  This  documentation  included  a  majority  of 
working  papers  in  the  planning  phase  and  some  working  papers  in  the  survey  phase. 
All  working  papers  prepared  after  the  survey  phase  did  not  include  supervisory 
sign-off  reviews  in  the  project  files. 

•  Supervisory  review  of  12  of  the  14  finding  sheets  occurred  after  a  final  report  was 
issued.  Supervisory  review  of  additional  audit  documentation  also  occurred  after  the 
final  report  date. 

Audit  Evidence  and  Documentation 

Insufficient  Audit  Evidence  and  Documentation 

GAGAS  7.55  states  that  auditors  must  obtain  sufficient,  appropriate  evidence  to  provide  a 
reasonable  basis  for  their  findings  and  conclusions.  During  the  review,  we  identified  that  a 
project’s  working  papers  did  not  provide  sufficient  evidence  to  support  the  auditor’s 
conclusions  and  report  recommendation.  Specifically,  the  working  papers  described  the 
analytical  work  conducted;  however,  the  project  file  did  not  contain  evidence  showing  that  the 
work  described  was  completed.  Additionally,  some  working  paper  conclusions  were  not 
adequately  supported,  documented,  or  logical,  when  compared  to  information  documented  in 
the  record  of  work  done  summary.  The  responsible  auditor  stated  that  they  did  not  document 
any  evidence  of  analytical  work  performed  in  the  project  files.  Due  to  the  absence  of  sufficient 
and  appropriate  audit  evidence,  we  determined  that  the  report  conclusions  and  recommendation 
were  not  adequately  supported  or  reliable.  We  recommended  that  the  Audit  Director,  DLA 
Energy: 

•  immediately  rescind  report  number  DAF-09-26,  “Validation  Report  of  Corrective 
Actions  Taken  for  Plan  of  Actions  and  Milestones  15,  Contract  Modification  to 
Match  DESC  Guidance,”  November  2009; 

•  notify  all  recipients  of  the  rescission; 

•  document  in  the  official  working  paper  file  that  the  engagement  did  not  comply  with 
GAGAS; 

•  review  any  other  audits  that  may  have  referenced  the  work  performed  in  this  audit 
and  take  appropriate  actions  in  regards  to  them  depending  on  the  significance  of  this 
audit  to  the  other  assignments;  and 

•  review  all  work  completed  by  the  responsible  auditor  to  determine  compliance  with 
GAGAS. 

The  Deputy  Commander,  DLA  Energy  concurred  with  our  recommendations.  As  of 
December  16,  2010,  the  supervisor  had  reviewed  four  of  six  audits  completed  by  the  responsible 
auditor.  We  also  had  concerns  with  the  adequacy  of  audit  evidence  for  report  number 
DAF-09-26,  “Validation  Report  of  Corrective  Actions  Taken  for  Plan  of  Actions  and  Milestones 
15,  Contract  Modification  to  Match  DESC  Guidance,”  November  2009.  Specifically,  the 
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working  papers  described  analytical  work,  but  did  not  contain  evidence  to  show  that  the  work 
described  was  completed,  and  some  working  paper  conclusions  were  not  adequately  supported, 
documented,  or  logical. 

Poor  Quality  of  Audit  Evidence  and  Documentation 

Our  review  disclosed  noncompliance  with  audit  evidence  and  documentation  standards  at  five  of 
the  eight  offices.  GAGAS  7.77  states  that  auditors  should  prepare  audit  documentation  in 
sufficient  detail  to  enable  an  experienced  auditor,  having  no  previous  connection  to  the  audit,  to 
understand  from  the  audit  documentation  the  nature,  timing,  extent,  and  results  of  the  audit 
procedures  performed,  the  audit  evidence  obtained  and  its  source  and  the  conclusions  reached. 
Because  of  the  poor  quality  of  audit  evidence  and  documentation,  4  of  the  15  projects  reviewed 
required  extensive  verbal  explanation  to  enable  the  reviewers  to  understand  the  purpose  and 
significance  of  the  audit  documentation.  Examples  of  insufficient  and  incomplete  audit 
evidence  and  documentation  included  the  following: 

•  A  final  audit  report  contained  detailed  infonnation  regarding  the  sample  selection 
methodology  for  Continental  United  States  locations;  however,  this  infonnation  was 
not  documented  in  the  project  files. 

•  A  final  report  stated  that  interviews  were  held  with  subject  matter  experts,  area 
managers  and  field  activity  personnel.  However,  the  project  files  did  not  contain 
documentation  of  any  of  the  interviews. 

•  For  two  projects,  work  completed  was  not  documented  in  the  project  files.  Examples 
of  missing  documentation  include  an  auditor’s  analysis  of  contract  clauses  and  a 
review  of  accounting  transactions. 

•  A  project’s  working  papers  did  not  contain  support  for  the  report  finding. 

•  A  scope  limitation  was  identified  in  an  audit  sampling  plan.  However,  the  scope 
limitation’s  impact  on  the  audit  and  the  auditor’s  conclusions  were  not  documented  in 
the  project  files. 

Lack  of  Policies  to  Ensure  Compliance  with  Audit  Evidence  and 
Documentation  Requirements 

The  DLA  Accountability  Office,  Audit  Division,  had  not  developed  policies  to  ensure 
compliance  with  GAGAS  audit  documentation  requirements.  GAGAS  7.81  states  that  when 
audit  organizations  do  not  comply  with  applicable  GAGAS  requirements  due  to  law,  regulation, 
scope  limitations,  restrictions  on  access  to  records,  or  other  issues  impacting  the  audit,  the 
auditors  should  document  the  departure  from  GAGAS  and  the  impact  on  the  auditor’s 
conclusions.  Our  review  disclosed  an  audit  report  containing  a  modified  GAGAS  statement 
resulting  from  an  organizational  impairment  to  independence.  However,  the  report  did  not 
include  information  regarding  the  reasons  why  GAGAS  standards  for  independence  were  not 
followed,  and  how  not  following  the  requirements  affected,  or  could  have  affected  the  audit. 
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In  addition,  a  second  audit  project  identified  a  scope  impairment  in  the  sampling  plan  working 
papers.  However,  this  scope  limitation  and  its  effect  on  the  auditor’s  conclusions  were  not 
documented  in  the  final  audit  report. 


Retention  of  Audit  Evidence  and  Documentation 

GAGAS  7.82  states  that  audit  organizations  should  establish  policies  and  procedures  for  safe 
custody  and  retention  of  audit  documentation  for  a  time  sufficient  to  satisfy  legal,  regulatory,  and 
administrative  requirements  for  records  retention.  Additionally,  for  audit  documentation  that  is 
retained  electronically,  the  audit  organization  should  establish  infonnation  systems  controls  for 
accessing  and  updating  the  audit  documentation.  During  our  review  of  an  audit  assignment,  the 
auditor’s  analysis  of  117  transactions,  significant  to  the  report  findings  and  recommendations, 
was  not  included  in  the  electronic  file.  The  analysis  was  missing  because  of  ongoing  software 
and  hardware  problems.  When  the  electronic  file  was  compromised,  the  auditor  did  not 
reperform  the  work  because  current  DLA  policies  do  not  contain  this  requirement. 

Reporting 

Noncompliance  with  GAGAS  Reporting  Requirements 

Four  of  the  eight  audit  offices  did  not  comply  with  GAGAS  reporting  standards.  Examples  of 
significant  deficiencies  include  the  following: 


Location 

Summary  of  Finding 

Disposition 

Services 

The  report  format  did  not  follow  guidance  contained  in  the  GAGAS  standard 
for  attestation  engagements  or  the  AICPA  Statement  of  Standards  on 

Attestation  Engagements  number  10,  as  amended  by  Standards  on  Attestation 
Engagement  No.  14,  AT  Section  101,  Attest  Engagements,  Standards  of 
Reporting,  AT  101.63-87.  (Report  No.  DA-09-05) 

Energy 

The  working  papers  did  not  support  the  audit  report  conclusions  and 
recommendation  because  of  the  lack  of  audit  documentation.  The  report  scope 
and  methodology  did  not  adequately  describe  the  work  perfonned.  The  report 
does  not  provide  infonnation  on  the  universe  of  contracts  that  were  tested. 
(Report  No.  DAF-09-26) 

Aviation 

A  scope  limitation  was  identified  in  the  audit  sampling  plan.  However,  this 
information  was  not  discussed  in  the  audit  report.  Also,  the  report  did  not 
adequately  describe  the  audit  sampling  methodology  or  design.  (Report  No. 
IA-DSCR-CFOAP-2008-01) 

Troop  Support 

The  audit  office  did  not  provide  any  final  audit  reports  that  were  issued  during 

FY  2008  and  FY  2009  in  our  initial  data  call.  GAGAS  8.05  states  that  the 
purpose  of  audit  reports  are  to  communicate  the  results  of  audits  to  those 
charged  with  governance,  the  appropriate  officials  of  the  audited  entity,  and  the 
appropriate  oversight  officials.  The  audit  office  did  not  have  a  clearly  defined 
audit  reporting  process. 
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Application  of  Attestation  Standards 

We  found  that  the  DLA  Accountability  Office,  Audit  Division,  and  the  DLA  Disposition 
Services  audit  offices  did  not  correctly  apply  attestation  standards  for  reporting.  GAGAS  6.30 
requires  the  use  of  four  AICPA  standards  to  follow  for  reporting  on  attestation  engagements. 
Additionally,  GAGAS  6.31  establishes  reporting  standards  for  attestation  engagements,  in 
addition  to  the  requirements  discussed  in  the  AICPA  standards.  We  found  that  the  DLA 
Disposition  Services  audit  office  stated  that  the  auditors  followed  the  performance  audit 
standards  when  performing  their  work,  however,  the  report  stated  it  was  an  attestation 
engagement.  Because  the  report  stated  that  it  was  done  in  accordance  with  attestation  standards, 
we  applied  the  attestation  standards  for  our  review.  As  a  result,  the  report  fonnat  did  not  adhere 
to  the  guidance  contained  in  either  the  GAGAS  or  AICPA  reporting  standards  for  attestation 
engagements. 

Reporting  Process 

GAGAS  8.05  states  that  the  purpose  of  audit  reports  are  to  communicate  the  results  of  audits  to 
those  charged  with  governance,  the  appropriate  officials  of  the  audited  entity,  and  the  appropriate 
oversight  officials.  One  DLA  audit  office  did  not  have  a  clearly  defined  audit  reporting 
process  which  led  the  auditors  to  conclude  that  those  charged  with  governance  either  did  not 
receive  the  audit  results,  or  did  not  convey  the  audit  findings  to  DLA  management  who  could 
take  action  on  the  audit  findings.  Because  of  absence  of  a  fonnal  reporting  process,  the  audit 
office  could  not  provide  any  final  audit  reports  issued  during  FY  2008  and  FY  2009. 

Other  Issues 

Audits  of  High  Risk  Troop  Support  Area  Not  in  the  Plan 

The  DLA  Troop  Support  mission  encompasses  providing  the  U.S.  military  with  food,  clothing, 
textiles,  medicines,  medical  equipment  and  construction  supplies  and  equipment.  DLA  Troop 
Support  also  supports  U.S.  humanitarian  and  disaster  relief  efforts.  In  FY  2010,  DLA  Troop 
Support  had  $14,789  billion  in  sales.  However,  the  DLA  Troop  Support  audit  office  did  not 
have  an  approved  audit  plan  in  place  for  FY  2010  to  identify  areas  of  risk  to  be  audited; 
therefore,  it  was  not  included  in  the  overall  DLA  audit  plan  signed  by  the  DLA  Director. 

DoD  Instruction  7600.02,  “Audit  Policies,”  dated  April  27,  2007,  states  that  management  needs 
and  high-risk  areas  shall  be  considered  in  the  development  of  audit  plans.  When  completed,  the 
audit  organizations  shall  review  their  audit  plan  with  the  Head  or  Deputy  Head  of  the  DoD 
Component,  command,  or  activity  that  has  operational  control  over  the  DoD  audit  organization. 
Further,  the  Department  of  Defense  7600. 07-M,  “DoD  Audit  Manual,”  dated  February  13,  2009, 
states  that  DoD  audit  organizations  should  develop  a  planning  process  that  establishes  a  planning 
cycle  with  dates  specifying  the  stages  for  developing  the  plan.  An  audit  planning  cycle  should 
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be  conducted  on  an  annual  basis;  however,  another  cycle  may  be  used  if  best  suited  to  the 
organization  and  its  mission.  The  audit  plan  is  important  as  it  allows  for  the  review  of  high  risk 
areas  and  is  used  to  allocate  resources  to  address  those  areas. 

Despite  the  importance  of  the  DLA  Troop  Support  Mission  and  the  importance  of  an  audit  plan 
including  review  of  high  risk  areas,  there  were  no  audits  included  in  the  FY  2010  DLA  Audit 
Plan  for  DLA  Troop  Support.  Additionally,  there  were  no  final  audit  reports  issued  in  FY  2008 
and  FY  2009  according  to  audit  personnel  although  the  Deputy  Commander  and  Program 
Director  stated  three  audits  were  issued  in  the  two  year  timeframe.  Our  review  was  limited  to 
one  audit  report  issued  in  FY  2010  in  which  all  parties  agreed  the  report  was  issued.  Ultimately, 
we  concluded  that  no  DLA  Troop  Support  audits  were  included  in  the  plan  and  only  one  to  at 
most  four  audit  reports  were  completed  in  the  total  of  the  last  3  years. 

Absence  of  a  Centralized  Reporting  System 

The  DLA  audit  organization  did  not  have  a  centralized  reporting  system  to  identify  issued  audit 
reports.  DLA  One  Book  Process  Chapter,  “Internal  Audit  Process,”  Section  3.1.12,  Annual 
Audit  Reporting,  dated  November  8,  2007,  states  that  by  October  3 1st  of  each  year,  the  DLA 
audit  offices  shall  provide  to  DLA  Accountability  Office  the  report  number,  title  and  objective  of 
each  audit  completed  under  its  jurisdiction  during  the  previous  fiscal  year.  Our  review  disclosed 
that  DLA  audit  offices  were  not  following  this  requirement.  We  found  that  in  some  instances, 
the  DLA  Accountability  Office,  Audit  Division,  was  not  aware  of  audit  reports  issued  by  the 
audit  offices.  In  November  2009,  we  requested  a  comprehensive  listing  of  the  reports  issued 
during  FY  2008-2009.  Because  the  organization  lacked  a  centralized  list  of  all  issued  reports, 
the  DLA  Accountability  Office,  Audit  Division,  sent  a  data  call  to  all  DLA  audit  offices  to  obtain 
this  information.  The  DLA  Audit  Division  had  requested  that  the  audit  offices  input  all  audit 
reports  into  an  automated  working  paper  system  so  that  it  could  be  reviewed  by  all  auditors 
within  DLA.  It  is  important  to  maintain  a  centralized  reporting  process  so  that  audit  reports  can 
be  utilized  to  review  any  high  risk  audit  areas,  and  assist  with  identifying  any  issues  that  may  be 
systemic  throughout  the  organization. 
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Recommendations,  Management  Comments,  and 
Our  Response 

We  recommend  that  the  Director,  DLA: 

1.  To  increase  compliance  with  GAGAS  standards,  require  the  audit  organization  to 
implement  official  policies  and  procedures;  which  all  audit  offices  are  required  to 
follow. 


a.  Review  the  following  audit  policies  for  sufficiency  and  accuracy: 
documentation  of  significant  decisions  resulting  from  professional  judgment, 
conduct  of  attestation  engagements,  information  system  controls,  termination 
of  audits,  documentation  requirements,  and  audit  reporting  procedures. 

b.  Develop  specific  policies  and  procedures  to  ensure  that  DLA  auditors  do  not 
perform  OMB  Circular  A-123  reviews  or  any  similar  nonaudit  services  or 
activities  that  would  impair  independence. 

Management  Comments.  The  Director,  DLA,  concurred.  Audit  policies  and 
procedures  have  been  updated.  It  is  expected  the  revised  audit  policy  will  be 
issued  in  March  2011.  DLA  will  also  establish  the  DLA  Office  of  Inspector 
General  to  conduct  audits  and  establish  local  internal  review  offices  to  provide 
assessments  to  local  Commanders.  Further,  the  DLA  Accountability  Office 
Director  issued  a  memorandum  on  December  2,  2010,  stating  that  all  non-audit 
services  related  to  OMB  Circular  A-123,  Appendix  A  would  cease  immediately. 
This  prohibition  will  be  incorporated  into  the  revised  policy  expected  to  be  issued 
in  March  2011. 

Our  Response.  The  management  comments  are  responsive.  When  completed, 
we  request  the  Director,  DLA,  to  provide  us  with  a  copy  of  the  revised  audit 
policies. 

2.  Establish  a  two-year  plan  identifying  either  audit  offices  or  high  risk  areas  to  review 
for  compliance  with  internal  quality  assurance  policies  and  procedures  and  GAGAS 
standards. 

Management  Comments.  The  Director,  DLA,  concurred.  The  Audit  Quality 
Control  and  Assurance  Policy  Handbook  will  be  revised  by  March  201 1,  to 
establish  a  requirement  to  develop  a  two-year  plan. 

Our  Response.  The  management  comments  are  responsive.  When  completed, 
we  request  the  Director,  DLA,  to  provide  us  with  a  copy  of  the  revised  Audit 
Quality  Control  and  Assurance  Policy  Handbook. 
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3.  At  least  annually,  the  Quality  Assurance  and  Audit  Management  Systems  team 
should  summarize  the  results  of  its  monitoring  procedures  and  report  the  results  to 
all  audit  offices. 

Management  Comments.  The  Director,  DLA,  concurred.  Starting  with 
FY  2011,  DLA  will  include  the  results  of  internal  quality  assurance  reviews  in  the 
DLA  Annual  Perfonnance  Report.  The  FY  2011  Annual  Performance  Report  will 
be  published  in  the  first  quarter  of  FY  2012. 

Our  Response.  The  management  comments  are  responsive.  When  published, 
we  request  the  Director,  DLA,  to  provide  us  with  a  copy  of  the  FY  2011  Annual 
Perfonnance  Report. 

4.  Require  any  DLA  audit  office  that  does  not  report  directly  to  their  local 
Commander  and/or  Deputy  Commander  to  immediately  realign  their  reporting 
structures  to  maintain  organizational  independence  in  both  fact  and  appearance. 

Management  Comments.  The  Director,  DLA,  concurred.  The  DLA 
headquarters  audit  organization  has  been  realigned  to  report  directly  to  the 
Director,  DLA.  The  reorganization  of  the  field  audit  offices  into  internal  review 
offices  will  address  this  recommendation  at  the  field  level. 

Our  Response.  The  management  comments  are  responsive.  We  request  the 
Director,  DLA,  to  provide  us  with  a  copy  of  the  order  that  authorized  the 
reporting  realignment  of  the  DLA  headquarters  audit  organization.  When  issued, 
we  also  request  the  Director,  DLA,  to  provide  us  with  a  copy  of  the  order  that 
authorizes  the  functional  realignment  of  the  DLA  audit  field  offices  to  DLA 
internal  review  field  offices.  In  addition,  we  request  a  timetable  of  when  the 
functional  realignment  of  the  audit  field  offices  to  internal  review  offices  is 
expected  to  be  completed. 

5.  Take  action  to  improve  the  audit  organization’s  understanding  and  knowledge  of 
the  following  GAGAS  standards:  performance  of  nonaudit  services,  independence 
requirements,  performing  and  reporting  on  attestation  engagements,  application  of 
attestation  standards,  using  the  work  of  external  specialists,  planning,  supervision, 
evidence,  audit  documentation,  and  reporting  requirements. 

Management  Comments.  The  Director,  DLA,  concurred.  Once  the  internal 
audit/intemal  review  is  completed,  DLA  will  conduct  GAGAS  refresher  training 
for  all  DLA  OIG  auditors,  as  well  as  training  on  the  new  DLA  audit  policy.  The 
training  will  occur  by  April  2011. 

Our  Response.  The  management  comments  are  responsive.  We  request  the 
Director,  DLA,  to  provide  us  with  a  copy  of  the  order  that  authorized  the 
reporting  realignment  of  the  DLA  headquarters  audit  organization.  When  issued, 
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we  also  request  the  Director,  DLA,  to  provide  us  with  a  copy  of  the  order  that 
authorizes  the  functional  realignment  of  the  DLA  audit  field  offices  to  DLA 
internal  review  field  offices.  In  addition,  we  request  a  timetable  of  when  the 
functional  realignment  of  the  audit  field  offices  to  internal  review  offices  is 
expected  to  be  completed.  Additionally,  we  request  a  copy  of  the  training 
syllabus  and  curriculum  to  ensure  ourselves  all  standards  covered  by  this 
recommendation  are  adequately  addressed. 

6.  Review  and  formalize  the  DLA  audit  organization’s  process  for  recruitment,  hiring, 
continuous  development,  assignment,  and  evaluation  of  staff  to  ensure  maintenance 
of  a  competent  workforce.  Factors  to  consider  in  the  formalization  of  the  process 
should  include  review  of  the  size  of  the  audit  organization,  its  structure,  and  the 
work  being  performed. 

Management  Comments.  The  Director,  DLA,  concurred.  DLA  is  working 
with  Human  Resources  to  develop  a  plan  for  hiring,  retaining,  and  training 
auditors.  Competencies  are  being  developed  in  coordination  with  the  Office  of 
the  Secretary  of  Defense,  Comptroller,  and  will  provide  an  overall  model  for 
hiring,  training,  and  career  mapping  for  the  0511  occupational  series.  An  auditor 
training  matrix  is  also  being  developed.  By  April  2011,  DLA  will  have 
completed  the  auditor  skills  assessment  and  work  experience  questionnaire. 

Our  Response.  The  management  comments  are  responsive.  We  request  the 
Director,  DLA,  to  provide  us  with  copies  of  the  detailed  plan,  the  overall  model 
for  hiring,  training,  and  career  mapping,  and  when  completed,  the  auditor  skills 
assessment  and  work  experience  questionnaire. 

7.  Provide  GAGAS  training  to  all  auditors  including  training  on  attestation 
engagements;  performing  audit  and  fraud  risk  assessments;  and  independent 
reference  reviews  at  a  minimum. 

Management  Comments.  The  Director,  DLA,  concurred.  Once  the  internal 
audit/intemal  review  is  completed,  DLA  will  conduct  GAGAS  refresher  training 
for  all  DLA  OIG  auditors,  as  well  as  training  on  the  new  DLA  audit  policy.  The 
training  will  occur  by  April  2011. 

Our  Response.  The  management  comments  are  responsive.  We  request  the 
Director,  DLA,  to  provide  us  with  a  copy  of  the  order  that  authorized  the 
reporting  realignment  of  the  DLA  headquarters  audit  organization.  When  issued, 
we  request  the  Director,  DLA,  to  provide  us  with  a  copy  of  the  General  Order  that 
authorizes  the  functional  realignment  of  the  DLA  audit  field  offices  to  DLA 
internal  review  field  offices.  Also,  we  request  a  timetable  of  when  the  functional 
realignment  of  the  audit  field  offices  to  internal  review  offices  is  expected  to  be 
completed.  Additionally,  we  request  a  copy  of  the  training  syllabus  and 


27 


curriculum  to  ensure  ourselves  all  standards  covered  by  this  recommendation  are 
adequately  addressed. 

8.  Ensure  all  audit  offices  have  an  approved  annual  audit  plan  in  place  that  covers 
high  risk  areas. 

Management  Comments.  The  Director,  DLA,  concurred.  The  new  DLA 
audit  policy  will  require  audit  offices  to  develop  and  publish  an  annual  audit  plan. 
The  DLA  audit  policy  will  be  issued  by  March  2011. 

Our  Response.  The  management  comments  are  responsive.  We  request  the 
Director,  DLA,  to  provide  us  with  a  copy  of  the  audit  policy  on  annual  audit 
plans. 

9.  Require  all  audit  offices  to  input  final  reports  into  the  DLA  automated  working 
paper  system. 

Management  Comments.  The  Director,  DLA,  concurred.  The  DLA 
Accountability  Office  will  review  the  draft  policies  and  require  all  audit  teams  to 
use  the  automated  working  paper  system  for  all  audits.  This  DLA  audit  policy 
will  be  issued  by  March  2011. 

Our  Response.  The  management  comments  are  responsive.  When  completed, 
we  request  the  Director,  DLA,  to  provide  us  with  a  copy  of  the  audit  policy  on 
using  the  automated  working  paper  system  for  all  audits. 
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Appendix  B.  Summary  of  Interview  Results 
Relating  to  DLA  Audit  Policies  and  GAGAS 

We  interviewed  71  DLA  Audit  Division  and  field  office  staff  to  determine  their  knowledge  of 
DLA  audit  policies  and  GAGAS.  The  interviews  consisted  of  questions  related  to  DLA  Audit 
Division  audit  policies  and  GAGAS  general  standards,  field  work  standards,  and  reporting 
standards.  A  summary  of  the  results  of  the  responses  received  follows: 


Areas  Pertaining  to  DLA  Audit  Division 
Policies  and  GAGAS  Standards 

Responses  to  Questions 

1 .  Awareness  of  DLA  Audit  Policies 

All  staff  were  aware  of  audit  policies. 

2.  Compliance  with  GAGAS 

Most  staff  stated  that  their  work  complied  with 
GAGAS  standards. 

3.  Independence 

Most  staff  did  not  encounter  any  external  or 
organizational  independence  impairments 
when  perfomiing  their  work. 

All  staff  stated  that  they  did  not  perform  any 
nonaudit  services  that  could  impact 
independence. 

4.  Competence 

Staff  responses  indicated  that  the  competency 
requirement  was  fulfilled. 

5.  Quality  Control  and  Assurance 

Depending  on  years  of  auditing  experience 
and  length  of  employment  at  DLA,  answers 
varied  from  extensive  to  minimal 
understanding  of  quality  control  procedures. 

6.  Planning  (Key  Decisions) 

Staff  involved  with  audit  planning 
documented  key  planning  decisions  and 
communicated  with  the  client  throughout  the 
planning  phase. 

7.  Planning  (Fraud) 

Responses  varied  from  conducting  detailed 
fraud  risk  assessments  to  not  performing  any 
assessment  of  fraud  risk. 

8.  Supervision 

All  staff  stated  that  they  received  or  provided 
adequate  supervision. 

9.  Audit  Documentation 

Staff  provided  examples  of  activities  to  ensure 
that  audit  reports  are  properly  supported. 

10.  Evidence 

Staff  provided  examples  of  actions  to  ensure 
that  audit  evidence  is  supported  in  the  final 
report. 

11.  Reporting  (Timeliness) 

Staff  provided  examples  of  activities  to  ensure 
that  information  provided  in  reports  are 
current  and  relevant. 
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Appendix  C.  Scope  and  Methodology 

We  reviewed  the  adequacy  of  the  DLA  Audit  Division  and  eight  DLA  audit  offices’  compliance 
with  DLA  Audit  Division  quality  policies,  procedures,  and  GAGAS.  We  did  not  review  work 
completed  by  the  DLA  Document  Services  audit  office  because  it  did  not  complete  any  audit- 
related  work  during  the  review  period.  In  May  2010,  the  employee’s  job  series  was  converted 
from  a  GS-05 11,  Auditor,  to  a  GS-0343,  Management  and  Program  Analyst,  to  ensure  that  the 
job  series  classification  accurately  reflects  the  nature  and  type  of  work  performed  at  that  audit 
office. 

We  reviewed  the  adequacy  of  the  design  of  policies  and  procedures  that  the  DLA  Audit  Division 
established  to  provide  reasonable  assurance  of  compliance  with  GAGAS  in  the  conduct  of  its 
audits  and  attestation  engagements.  The  following  policy  and  guidance  documents  were 
included  in  our  review: 

•  DLA  One  Book  Process  Chapter  “Internal  Audit  Process,”  November  8,  2007, 
establishes  policies,  processes,  and  responsibilities  for  the  perfonnance  of  internal 
audits  within  DLA. 

•  “Enterprise  Audit  Procedures,”  August  14,  2009,  provides  guidance  for  conducting 
enterprise-wide  audits. 

•  “Audit  Quality  Control  and  Assurance  Policy”  August  12,  2009,  details  the 
organization’s  overall  quality  control  guidance. 

In  perfonning  our  review,  we  considered  the  requirements  of  quality  control  standards  and  other 
auditing  standards  contained  in  the  2007  Revision  of  GAGAS  issued  by  the  Comptroller  General 
of  the  United  States.  GAGAS  3.56  states: 

The  audit  organization  should  obtain  an  external  peer  review  sufficient  in  scope  to 
provide  a  reasonable  basis  for  determining  whether,  for  the  period  under  review,  the 
reviewed  audit  organization’s  system  of  quality  control  was  suitably  designed  and 
whether  the  audit  organization  is  complying  with  its  quality  control  system  in  order 
to  provide  the  audit  organization  with  reasonable  assurance  of  conforming  with 
applicable  professional  standards. 

We  performed  this  review  from  December  2009  through  October  2010  in  accordance  with 
standards  and  guidelines  established  in  the  March  2009  Council  of  the  Inspectors  General  on 
Integrity  and  Efficiency  “Guide  for  Conducting  External  Peer  Reviews  of  Audit  Organizations  of 
the  Federal  Offices  of  Inspector  General.”  In  perfonning  this  review,  we  assessed,  reviewed,  and 
evaluated: 

•  the  adequacy  of  the  design  of  policies  and  procedures  that  the  DLA  Audit  Division 
established  to  provide  reasonable  assurance  of  compliance  with  GAGAS  in  the 
conduct  of  its  audits  and  attestation  engagements; 

•  staff  understanding  of  quality  control  policies  and  procedures; 
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•  independence  documentation  and  records  of  continuing  professional  education  to 
verify  the  measures  that  enable  the  identification  of  independence  impairments  and 
maintenance  of  professional  competence;  and 

•  fifteen  reports  and  related  project  documentation  to  detennine  whether  established 
policies,  procedures,  and  applicable  standards  were  followed. 

We  selected  17  reports  from  a  universe  of  reports  issued  by  DLA  auditors  during  FY  2008, 

FY  2009,  and  until  July  FY  2010.  We  tested  15  of  the  17  projects  for  compliance  with  the  DLA 
Audit  Division’s  system  for  quality  control  for  perfonnance  audits  and  attestation  engagements. 
Two  projects  selected  for  review  could  not  be  evaluated  because  they  were  incorrectly  classified 
as  (1)  perfonnance  audit,  and  (2)  agreed-upon  procedures  review.  Additional  research  and 
analysis  disclosed  that  the  two  projects  excluded  from  our  review  should  have  been  classified  as 
nonaudit  services.  Specifically,  auditors  from  the  DLA  Audit  Division  and  the  DLA  Distribution 
audit  office  conducted  Office  of  Management  and  Budget  Circular  A- 123,  Appendix  A,  internal 
control  testing,  which  is  classified  in  GAGAS  3.29j  as  a  nonaudit  service  for  the  following 
engagements: 

•  Internal  Control  Testing  Related  to  the  Hire  to  Retire  Business  Cycle  as  Required  by 
Office  of  Management  and  Budget  Circular  A-123,  Appendix  A,  report  number  DAF- 
09-17  (Classified  as  a  Perfonnance  Audit);  and 

•  Internal  Control  Testing  Related  to  Non  Energy  Inventory  Quantity  as  Required  by 
Office  of  Management  and  Budget  Circular  A-123  Appendix  A,  report  number  DDC- 
08-03  (Classified  as  Agreed-Upon  Procedures  Review). 

In  selecting  reports,  we  worked  with  the  DLA  Audit  Division  and  audit  offices  to  establish  the 
universe  of  reports  that  were  issued  during  the  review  period.  We  then  selected  reports  that  were 
representative  of  the  types  of  reviews  completed  at  each  audit  office.  For  some  audit  offices, 
enterprise-wide  audits  were  selected  because  the  audit  office  completed  the  majority  of  the  audit 
work  with  minimal  assistance  from  other  DLA  audit  offices.  We  also  selected  reports  issued 
during  FY  2010  to  measure  compliance  with  DLA  Audit  Division’s  quality  assurance  policies 
and  procedures  issued  during  August  2009.  In  other  instances,  FY  2010  reports  were  selected 
for  review  because  audit  work  completed  during  the  review  period  could  not  be  measured  against 
GAGAS  standards,  and  one  audit  office  did  not  issue  any  reports  during  FY  2008  and  FY  2009. 

The  following  table  identifies  the  specific  reports  reviewed  at  each  audit  office.  The  type  of 
review  column  contains  information  that  was  determined  by  the  report  GAGAS  compliance 
statement  and/or  type  of  review  described  in  the  final  report. 
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Audit  Office 

Report  Title,  Number,  Issue  Date 

Type  of  Review 

DLA  Audit  Division 

DAO-09- 10,  “Defense  Logistics  Agency  (DLA) 
Transfer  of  Nuclear  Weapons  Related  Material 
(NWRM)  to  the  United  States  Air  Force  (USAF),” 
August  18,  2009 

Performance/Enterprise 

DAF-09-17,  “Internal  Control  Testing  Related  to  the 
Defense  Logistics  Agency  (DLA)  Hire  to  Retire 
Business  Cycle  as  Required  by  the  OMB  A-123, 
Appendix  A,”  August  31,  2009 

Performance3 

DAI-09-33,  “Validation  of  Notice  of  Deficiency 
(NOD)  13,  14,  and  15  -  Corrective  Actions  Taken 
Related  to  Deficiency  of  RACF  Security  Settings, 
Recertification  of  DFAMS  Privileged  Accounts, 
DFAMS  Audit  Logs  and  System  Software  Change 
Control  Weaknesses,”  January  26,  2010 

Performance/Validation 

DLA  Energy 

DAF-09-26,  “Final  Validation  Report  of  Corrective 
Actions  Taken  for  Plan  of  Actions  and  Milestones 
(POAM)  15,  Contract  Modification  to  Match  DESC 
Guidance,”  November  2,  2009 

Performance/Validation 

08-07,  “Audit  Report  of  the  Verification  of  Project 
765’s  Account  Balance,”  June  1,  2009 

Performance 

DLA  Troop  Support 

DSCP-09-05,  “Government  Purchase  Card  Program 
Defense  Supply  Center  Philadelphia,” 

December  9,  2009 

Performance 

DLA  Logistics 
Information  Service 

DLIS-09-15,  “FISMA  Compliance  Audit,” 

October  16,  2009 

Performance 

DLIS-09-1 1,  “Customer  Interaction  Center,” 

July  8,  2009 

Performance 

DLIS-10-03,  “Customer  Interaction  Center  (CIC) 
Follow  Up  Report,”  May  24,  2010 

Performance 

DLA  Disposition 

Services 

DA-09-05,  “DRMS  Vulnerability  Assessment,” 

April  23,  2009 

Examination-level 

Attestation 

DRMS-09-03  “Controls  Over  RTD/Direct  Removals,” 
October  15,  2009 

Performance 

DLA  Land  and 
Maritime 

DSCC-DI-09-28  “Audit  of  DSCC  Government 

Purchase  Cards,”  March  31,  2010 

Performance 

DSCC-DI-09-49,  “Value  Engineering  Savings-MRAP 
Power  Supply  Assembly,”  August  20,  2009 

Performance 

DLA  Distribution 

DAO-09- 13  “Defense  Distribution  Depot, 

Susquehanna,  PA  (DDSP)  Distribution  Process 
Review,”  December  30,  2009 

Performance/  Enterprise 

DDC-08-03,  “Defense  Logistics  Agency  Fiscal  Year 
2008  Non  Energy  Inventory  Quality  Distribution 
Operations  Control  Tests,”  August  6,  2008 

Agreed  Upon 
Procedures4 

DLA  Aviation 

1A-DSCR-CFOAP -2008-01,  “Final  Report  for  the 
Validation  Results  of  the  DDC  End  of  Month 
Transportation  Accruals,”  September  2,  2008 

Performance/Validation 

DAO-09- 12,  “Audit  of  Military  Construction 

Resulting  from  Base  Realignment  and  Closure  2005,” 
January  27,  2010 

Performance/Enterprise 

3  Nonaudit  service  incorrectly  classified  as  a  performance  audit. 

4  Nonaudit  service  incorrectly  classified  as  an  agreed  upon  procedures  engagement. 
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Limitations  of  Review 


Our  review  would  not  necessarily  disclose  all  weaknesses  in  the  system  of  quality  control  or  all 
instances  of  noncompliance  because  we  based  our  review  on  selective  tests.  There  are  inherent 
limitations  in  considering  the  potential  effectiveness  of  any  quality  control  system.  Departures 
from  GAGAS  can  result  from  misunderstood  instructions,  mistakes  in  judgment,  carelessness,  or 
other  human  errors.  Projecting  any  evaluation  of  a  quality  control  system  is  subject  to  the  risk 
that  one  or  more  procedures  may  become  inadequate  because  conditions  may  change  or  the 
degree  of  compliance  with  procedures  may  deteriorate. 
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Appendix  D.  Defense  Logistics  Agency 

Comments 


IN  REPLY 
REFER  10 


DEFENSE  LOGISTICS  AGENCY 
HEADQUARTERS 
8725  JOHN  J.  KINGMAN  ROAD 
FORT  BELVOIR,  VIRGINIA  22060-6221 


FEB  2  2  2011 


MEMORANDUM  FOR  ASSISTANT  INSPECTOR  GENERAL,  AUDIT  POLICY  AND 
OVERSIGHT 

ATTENTION:  MS.  CAROLYN  DAVIS 

SUBJECT:  Comments  to  Department  of  Defense  Inspector  General  (DoDIG)  Preliminary 
Review  Results:  “Quality  Control  Review  of  the  Defense  Logistics  Agency 
Accountability  Office”,  DoDIG  (Project  Number:  D2010-DIPOAI-0053.000) 


The  Defense  Logistics  Agency  has  reviewed  subject  DoDIG  preliminary  review  results 
and  we  concur  with  the  finding  and  recommendation.  A  copy  of  our  response  to  the 
recommendation  is  attached. 

The  point  of  contact  for  this  action  is  Mr.  Frederick  Baillie,  at  (703)  767-5440,  or  email: 
frcdcrick.baillic@dla.mil. 


A.  S.  THOMPSON 
Vice  Admiral,  SC,  USN 
Director 
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Federal  Recycling  Program  U  Printed  on  Recycled  Paper 


DRAFT  OF  EXTERNAL  QUALITY  CONTROL  REVIEW  OF  TILE  DEFENSE 
LOGISTICS  AGENCY  (DLA)  AUDIT  ORGANIZATION 

DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL  (DoDIG)  Project  Number: 
D201 0-DI  POAI-0053.00U 

DLA  COMMENTS  TO  THE  RECOMMENDATION 


DLA  appreciates  the  opportunity  to  review  the  DLA  peer  review  draft  report.  We  also  would 
like  to  thank  the  audit  team  for  their  professionalism  and  attention  to  detail  during  the 
performance  of  the  peer  review.  We  take  your  results  very  seriously  and  have  already  taken 
corrective  actions  to  quickly  correct  the  deficiencies  identified.  We  strive  to  have  a  world  class 
audit  organization  which  provides  independent,  objective  and  thorough  audits  of  DLA  high  risk 
areas.  Please  sec  our  specific  corrective  actions  and  timelines  for  each  recommendation  below. 

RECOMMENDATION  1:  To  increase  compliance  with  the  Generally  Accepted  Government 
Auditing  Standards  (GAGAS),  require  the  audit  organization  to  implement  official  policies  and 
procedures;  which  all  audit  offices  are  required  to  follow. 

a.  Review  the  following  audit  policies  for  sufficiency  and  accuracy,  documentation  of 
significant  decisions  resulting  from  professional  judgment,  conduct  of  attestation 
engagements,  information  system  controls,  termination  of  audits,  documentation 
requirements,  and  audit  reporting  procedures. 

b.  Develop  specific  policies  and  procedures  to  ensure  the  DLA  auditors  do  not  perform 
Office  of  Management  and  Budget  (OMB)  Circular  A-123  reviews  or  any  similar 
nonaudit  services  or  activities  that  would  impair  independence. 

DLA  RESPONSE: 

la.  Concur.  Audit  policies  and  procedures  have  been  updated  to  include 

improvements  suggested  by  the  DoDIG  peer  review  team.  We  will  coordinate 
these  policies  across  the  agency  and  anticipate  that  the  revised  policy  will  be  issued 
final  in  March  201 1 .  DLA  will  establish  the  DLA  Office  of  Inspector  General 
(OIG)  to  conduct  audits  in  high  risk  areas  across  DLA  as  well  as  establish  local 
internal  review  offices  which  will  no  longer  conduct  GAGAS  audits.  The  internal 
review  offices  will  provide  independent  assessments  to  local  Commanders. 

1  b.  As  the  DoDIG  report  states,  the  DLA  Accountability  Office  Director  issued  a 
memorandum  on  December  2, 2010,  stating  that  all  non-audit  sendees  related  to 
OMB  Circular  A-123,  Appendix  A  would  cease  immediately.  This  prohibition  will 
be  incorporated  into  the  revised  policy  that  will  be  issued  in  March  2011. 
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RECOMMENDATION  2:  Establish  a  two-year  plan  identifying  cither  audit  offices  or  high 
risk  areas  to  review  for  compliance  with  internal  quality  assurance  and  policies  and  procedures 
and  GAGAS  standards. 

DLA  RESPONSE:  Concur.  Revisions  to  the  Audit  Quality  Control  and  Assurance 
Policy  handbook  will  include  a  specific  requirement  to  develop  a  two-year  plan 
identifying  the  process  for  selecting  audits  subject  to  quality  assurance  review.  The 
policy  will  ensure  that  the  audit  quality  team  provides  adequate  coverage  to  all  teams, 
high-risk  topics,  and  sized  audits.  The  revised  policy  will  be  issued  by  March  2011. 

RECOMMENDATION  3:  At  least  annually,  the  Quality  Assurance  and  Audit  Management 
Systems  team  should  summarize  the  results  of  its  monitoring  procedures  and  report  the  results  to 
all  audit  offices. 

DLA  RESPONSE:  Concur.  DLA  publishes  an  Annual  Pcrfomrancc  Report  (APR)  that 
is  distributed  to  DLA  senior  leadership.  The  performance  report  outlines  the  support  that 
auditors  have  provided  to  DLA  and  the  results  of  significant  audits.  Beginning  with  the 
Fiscal  Year  201 1  (FY1 1)  report,  DLA  will  also  include  the  results  of  internal  quality 
assurance  reviews  in  the  report.  The  FY1 1  APR  will  be  published  in  the  first  quarter  of 
FY12. 


RECOMMENDATION  4:  Require  any  DLA  audit  office  that  does  not  report  directly  to  their 
local  Commander  and/or  Deputy  Commander  to  immediately  realign  their  reporting  structures  to 
maintain  organizational  independence  in  both  fact  and  appearance. 

DLA  RESPONSE:  Concur.  DLA  concurs  that  all  audit  offices  should  report  to  cither 
the  commander  or  deputy.  The  reorganization  of  the  field  audit  offices  into  internal 
review  offices,  will  address  this  recommendation  at  the  field  level.  The  DLA 
headquarters  audit  organization  has  been  realigned  to  report  directly  to  the  DLA  Director 
for  all  matters. 


RECOMMENDATION  5:  Take  action  to  improve  the  audit  organization’s  understanding  and 
knowledge  of  the  following  GAGAS  standards:  performance  of  non-audit  services, 
independence  requirements,  performing  and  reporting  on  attestation  engagements,  application  of 
attestation  standards,  using  the  work  of  external  specialist,  planning,  supervision,  evidence,  audit 
documentation,  and  reporting  requirements. 

DLA  RESPONSE:  Concur.  Once  the  audit/internal  review  functional  realignment  is 
completed,  DLA  will  conduct  GAGAS  refresher  training  for  all  DLA  OIG  auditors.  We 
arc  developing  the  course  syllabus  with  instructors  from  the  Graduate  School. 
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Concurrent  with  the  GAGAS  training,  DLA  will  also  conduct  training  on  the  new  DLA 
audit  policy.  The  training  will  occur  by  April  2011. 


RECOMMENDATION  6:  Review  and  formalize  the  DLA  audit  organization’s  process  for 
recruitment,  hiring,  and  continuous  development,  assignment,  and  evaluation  of  staff  to  ensure 
maintenance  of  a  competent  workforce.  Factors  to  consider  in  the  formalization  of  the  process 
should  include  review  of  the  size  of  audit  organizations,  its  structure,  and  the  work  being 
performed. 

DLA  RESPONSE:  Concur.  DLA  has  taken  steps  to  review  the  organizational  structure 
of  our  audit  organization  and  we  are  making  adjustments  needed  to  realign  the  audit  and 
internal  review  functions.  The  0511  audit  series  has  been  identified  within  DoD  as  a 
mission  critical  occupation.  We  are  actively  working  with  DLA  Human  Resources  to 
develop  a  detailed  plan  for  hiring,  retaining  and  training  our  auditors.  Competencies  are 
being  developed  in  coordination  with  the  Office  Under  Secretary  of  Defense 
(Comptroller)  and  will  provide  an  overall  model  for  hiring,  training,  and  career  mapping 
for  the  0511  occupational  series.  DLA  is  also  developing  an  auditor  training  matrix  to 
ensure  that  all  auditors  receive  the  most  relevant  training  as  they  develop  through  their 
careers.  While  the  DoD  mission  critical  occupation  taskforce  work  is  ongoing,  by  April 
201 1,  DLA  will  have  completed  the  auditor  skills  assessment  and  work  experience 
questionnaire.  Once  the  audit/intemal  review  functional  realignment  is  complete,  we  will 
assess  the  DLA  OIG  audit  organization  size  and  the  work  being  performed  to  determine 
if  there  arc  an  adequate  number  of  auditors  to  focus  on  DLA  high  risk  areas. 

RECOMMENDATION  7:  Provide  GAGAS  training  to  all  auditors  including  training  on 
attestation  engagements;  performing  audit  and  fraud  risk  assessments;  and  independence 
reference  reviews  at  a  minimum. 

DLA  RESPONSE:  Concur.  Once  the  audit/internal  review  functional  realignment  is 
completed,  DLA  will  conduct  GAGAS  refresher  training  for  all  DLA  OIG  auditors.  We 
are  developing  the  course  syllabus  with  personnel  from  the  Graduate  School.  Concurrent 
with  the  GAGAS  training,  DLA  will  also  conduct  training  on  the  new  DLA  audit  policy. 
The  training  will  occur  by  April  2011. 


RECOMMENDATION  8:  Ensure  all  audit  offices  have  an  approved  annual  audit  plan  in  place 
that  covers  high  risk  areas. 

DLA  RESPONSE:  Concur.  The  DLA  Accountability  Office  will  review  the  draft 
policies  and  require  each  audit  office  to  develop  and  publish  an  annual  audit  plan.  This 
DLA  audit  policy  will  be  issued  by  March  2011. 
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RECOMMENDATION  9:  Require  all  audit  offices  to  input  final  reports  into  the  DLA 
automated  working  paper  system. 

DLA  RESPONSE:  Concur.  The  DLA  Accountability  Office  will  review  the  draft 
policies  and  require  all  audit  teams  to  use  the  automated  working  paper  system  for  all 
audits.  This  DLA  audit  policy  will  be  issued  by  March  2011. 
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